diff --git a/internal/config/config.go b/internal/config/config.go
index bb6965d..9371299 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -3,6 +3,7 @@ package config
 import (
 	"fmt"
 	"os"
+	"path/filepath"
 
 	"gopkg.in/yaml.v3"
 )
@@ -125,5 +126,13 @@ func Load(path string) (*Config, error) {
 	if c.Dispatcher.MaxConcurrentRuns == 0 {
 		c.Dispatcher.MaxConcurrentRuns = 3
 	}
+	// Default the agent asset dir alongside the database file so upgrades
+	// from configs predating the agent.asset_dir field pick up a sensible
+	// location automatically — install.sh creates exactly this directory
+	// and drops vetting-agent-linux-amd64 into it, so /assets/* serves
+	// without the operator having to touch vetting.yaml.
+	if c.Agent.AssetDir == "" {
+		c.Agent.AssetDir = filepath.Join(filepath.Dir(c.Database.Path), "assets")
+	}
 	return &c, nil
 }